(1) Prescription information submitted to the department shall be confidential, in compliance with chapter 70.02 RCW and federal health care information privacy requirements and not subject to disclosure, except as provided in subsections (3) and (4) of this section.

     (2) The department shall maintain procedures to ensure that the privacy and confidentiality of patients and patient information collected, recorded, transmitted, and maintained is not disclosed to persons except as in subsections (3) and (4) of this section.

     (3) The department may provide data in the prescription monitoring program to the following persons:

     (a) Persons authorized to prescribe or dispense controlled substances, for the purpose of providing medical or pharmaceutical care for their patients;

     (b) An individual who requests the individual's own prescription monitoring information;

     (c) Health professional licensing, certification, or regulatory agency or entity;

     (d) Appropriate local, state, and federal law enforcement or prosecutorial officials who are engaged in a bona fide specific investigation involving a designated person;

     (e) Authorized practitioners of the department of social and health services regarding medicaid program recipients;

     (f) The director or director's designee within the department of labor and industries regarding workers' compensation claimants;

     (g) The director or the director's designee within the department of corrections regarding offenders committed to the department of corrections;

     (h) Other entities under grand jury subpoena or court order; and

     (i) Personnel of the department for purposes of administration and enforcement of this chapter or chapter 69.50 RCW.

     (4) The department may provide data to public or private entities for statistical, research, or educational purposes after removing information that could be used to identify individual patients, dispensers, prescribers, and persons who received prescriptions from dispensers.

     (5) A dispenser or practitioner acting in good faith is immune from any civil, criminal, or administrative liability that might otherwise be incurred or imposed for requesting, receiving, or using information from the program.

[2007 c 259 § 45.]